Privacy Policy

1. Who we are

ForgeFlow provides software that helps trophy, awards, engraving, and other custom-manufacturing businesses manage orders, artwork approvals, production workflows, invoicing, and customer communication. The data controller responsible for your information is [COMPANY LEGAL NAME], located at [COMPANY ADDRESS].

2. Information we collect

2.1 Information you provide

• Account and contact details such as name, business name, email address, phone number, and role.
• Billing information, such as billing address and payment method details (payment card data is handled by our payment processor, not stored by us).
• Content you enter into the Service, including customer records, order and engraving details, artwork and proof files, quotes, invoices, notes, and due dates.
• Communications you send us, including support requests, demo and consultation requests, and survey responses.

2.2 Information we collect automatically

• Usage data such as pages viewed, features used, actions taken, and timestamps.
• Device and log data such as IP address, browser type, operating system, and referring URLs.
• Cookies and similar technologies used to keep you signed in, remember preferences, and measure performance (see Section 8).

2.3 Information from third parties

We may receive information from service providers that support authentication, analytics, payments, and marketing, and from integrations you choose to connect to the Service.

3. How we use information

We use the information we collect to:

• Provide, operate, maintain, and secure the Service.
• Process orders, quotes, invoices, and payments.
• Respond to demo requests, consultations, support tickets, and other inquiries.
• Personalize and improve the Service and develop new features.
• Send administrative messages, service updates, and — where permitted — marketing communications you can opt out of.
• Detect, prevent, and address fraud, abuse, security incidents, and technical issues.
• Comply with legal obligations and enforce our agreements.

4. Legal bases for processing

Where the [GDPR / UK GDPR] applies, we process personal data under one or more of the following legal bases: performance of a contract, our legitimate interests (such as improving and securing the Service), your consent (which you may withdraw at any time), and compliance with legal obligations.

5. Customer data and our role as a processor

When you use the Service, you may store information about your own customers and orders. For that data, you are the controller and ForgeFlow acts as a processor on your behalf, handling it according to your instructions and our [DATA PROCESSING ADDENDUM]. You are responsible for having a lawful basis to collect and share that information with us.

6. How we share information

We do not sell your personal information. We share information only as described below:

• Service providers who process data on our behalf (hosting, analytics, payment processing, email delivery, and customer support).
• Integrations and connectors you enable, limited to what those integrations require.
• Legal and safety disclosures required by law, regulation, legal process, or to protect rights, property, and safety.
• Business transfers in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

7. Data retention

We retain personal information for as long as your account is active or as needed to provide the Service, and afterward only as required to meet legal, accounting, or reporting obligations. Retention periods vary by data type; contact us at [PRIVACY CONTACT EMAIL] for specifics.

8. Cookies and tracking

We use strictly necessary cookies to run the Site and optional cookies for analytics and preferences. You can control cookies through your browser settings and, where offered, our cookie banner. Disabling some cookies may affect how the Site functions.

9. Data security

We use administrative, technical, and organizational safeguards designed to protect information, including encryption in transit, access controls, and regular monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International data transfers

We may process and store information in countries other than where you are located, including [HOSTING REGION / COUNTRY]. Where required, we use appropriate safeguards such as standard contractual clauses for cross-border transfers.

11. Your rights and choices

Depending on where you live, you may have the right to:

• Access, correct, update, or delete your personal information.
• Object to or restrict certain processing, and request data portability.
• Withdraw consent where processing is based on consent.
• Opt out of marketing emails using the unsubscribe link in any message.
• Lodge a complaint with your local data protection authority.

To exercise these rights, contact us at [PRIVACY CONTACT EMAIL]. We may need to verify your identity before acting on a request.

12. Children’s privacy

The Service is intended for businesses and is not directed to children under [16 / 13]. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it.

13. Third-party links

The Site may link to third-party websites and services we do not control. This Policy does not apply to those sites, and we encourage you to review their privacy notices.

14. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice. Continued use of the Service after changes take effect means you accept the revised Policy.